EUVD-2026-110802

REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the type parameter of the metainfodefaultfieldscreate API. Attackers can craft a link with a valid CSRF token and HTML payload that rexview::message renders...